You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit elastic.co/guide.

Maintenance Windows

Suppress rule notifications for scheduled periods of time.

This content applies to:

Technical preview

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.

Alerts continue to be generated, however notifications are suppressed as follows:

  • When an alert occurs during a maintenance window, there are no notifications. When the alert recovers, there are no notifications--even if the recovery occurs after the maintenance window ends.
  • When an alert occurs before a maintenance window and recovers during or after the maintenance window, notifications are sent as usual.

Create and manage maintenance windows

In Project settingsManagementMaintenance Windows you can create, edit, and archive maintenance windows.

When you create a maintenance window, you must provide a name and a schedule. You can optionally configure it to repeat daily, monthly, yearly, or on a custom interval.

If you turn on Filter alerts, you can use KQL to filter the alerts affected by the maintenance window. For example, you can suppress notifications for alerts from specific rules:

A maintenance window can have any one of the following statuses:

  • Upcoming: It will run at the scheduled date and time.
  • Running: It is running.
  • Finished: It ended and does not have a repeat schedule.
  • Archived: It is archived. In a future release, archived maintenance windows will be queued for deletion.

When you view alert details in Kibana, each alert shows unique identifiers for maintenance windows that affected it.

On this page